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Synopsis: (U) To document the contents of the thumb drive acquired 
from the DOJ, and to give a brief summary of the files stored on the 
drive. 


Reason: 1.4(b) 

Derived From: National 
Security Information SCG 
Declassify On: 20411231 


Full Investigation Initiated: 09/23/2016 


Enclosure(s): Enclosed are the following items: 

1 (U//FOUO) Alfa Group Overview 9.1.16 

2 (U//FOUO) DNS Lookups For maill.trump email.com Through 9 14 
3 (U//FOUO) Log Of DNS Lookups For maill.trump email.com 851 
4 (U//FOUO) MX Lookups For 15 Trump Related Domains 

5 (U//FOUO) PTR Contains Trump 1933 

6. (U//FOUO) Trump And Mail MTA Relay Etc 537 

7 (U//FOUO) Trump Domains Registered 3352 

8 (U//FOUO) Trump Owned And Mail Systems 15 

9. (U//FOUO) Trump Owned And Mail Systems WHOIS 15 

10. (U//FOUO) White Paper v6 
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11. (U//FOUO) whitepaper comments 


Details: 


The report is a brief summary of the contents of the USB drive 
acquired by the FBI through the DOJ from an unknown third party on or 
about 9/19/16. This USB was provided as evidence to support the third 
party's claim that an unusually configured email server registered to 
the TRUMP ORGANIZATION was communicating with Russian based ALFA BANK. 
The following files appear to be the exported results of various 


queries surrounding Trump owned assets. 


(U) Files & Contents Summary: 


Alfa Group Overview 9.1.16.docx Contents Summary: A document 


discussing an overview of Russia's Alfa Group. 


DNS-Lookups-For-maill.trump-email.com-Through-9-14.txt Contents 


Summary: A text file containing IP address and domain pairs. 


Log-Of-DNS-Lookups-For-maill.trump-email.com-851.txt Content 
Summary: A text file containing 851 lines, each containing a date, 


time, timezone, domain, and IP address. 


MX-Lookups-For-15-Trump-Related-Domains. txt Content Summary: A 
text file containing 851 lines, each containing a date, time, 


timezone, domain, and IP address. 


PTR-Contains-Trump-1933.txt Contents Summary: A text document 
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containing 1,933 IP address and domain pairs. It can be assumed 
that this document is the result of a query and export from a 


website that provides domain name resolution. 


Trump-And-Mail-MTA-Relay-Etc-537.txt Contents Summary: A text 
file containing 537 IP address and domain pairs. All pairs contain 


either strings “mail” and or “trump.” 


Trump-Domains-Registered-3352.txt Contents Summary: A text file 
containing 3,352 domains. All listed domains contain the string 


*Erunp, 


Trump-Owned-And-Mail-Systems-15.txt Contents Summary: A text 


file containing 15 IP address and domain pairs. 


Trump-Owned-And-Mail-Systems-WHOIS-15.txt Contents Summary: A 
text file apparently containing the exported results of a WHOIS 
search from hosting server GoDaddy concerning domain name 


TRUMP EMAIL.COM 


White Paper v6.docx Contents Summary: A document showing the 
source's findings, discussions, results, and conclusions 


concerning White Paper. 
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whitepaper comments.pdf Contents Summary: A document discussing 
independent comments over Time Series Analysis of Recursive 


Queries concerning White Paper. 
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